> sudo tcpdump -i any tcpdump: data link type LINUX_SLL2 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes 15:01:28.921972 ens33 Out IP ept.55660 > 123.208.120.34.bc.googleusercontent.com.https: Flags [P.], seq 1706429942:1706429981, ack 1072465052, win 63000, length 39 15:01:28.922423 ens33 In IP 123.208.120.34.bc.googleusercontent.com.https > ept.55660: Flags [.], ack 39, win 64240, length 0 15:01:28.971505 lo In IP localhost.33425 > localhost.domain: 48367+ [1au] PTR? 123.208.120.34.in-addr.arpa. (56) 15:01:28.971785 ens33 Out IP ept.50072 > _gateway.domain: 32506+ PTR? 123.208.120.34.in-addr.arpa. (45) 15:01:28.977216 ens33 In IP _gateway.domain > ept.50072: 32506 1/0/0 PTR 123.208.120.34.bc.googleusercontent.com. (98) 15:01:28.977492 lo In IP localhost.domain > localhost.33425: 48367 1/0/1 PTR 123.208.120.34.bc.googleusercontent.com. (109) 15:01:28.977796 lo In IP localhost.45140 > localhost.domain: 38317+ [1au] PTR? 168.14.168.192.in-addr.arpa. (56) 15:01:28.978066 ens33 Out IP ept.50288 > _gateway.domain: 21988+ PTR? 168.14.168.192.in-addr.arpa. (45)